Feeds

Unlocking CryptoLocker: How infosec bods hunt the fiends behind it

Looks like 2013's nastiest cyber-threat is run from Eastern Europe - or Russia

Using blade systems to cut costs and sharpen efficiencies

CryptoLocker, the Bitcoin-hungry ransomware menace that has become 2013’s most infamous malware, was likely created by a single hacker crew in Russia or former Eastern bloc states and is heavily targeting US and UK systems, researchers have exclusively revealed to The Register.

Dell SecureWorks’ Counter Threat Unit (CTU) set up a sinkhole operation not long after the uber ransomware emerged in September, registering multiple domains from a pot of those used by CryptoLocker. Between October 22nd and November 1st, around 31,866 unique IP addresses contacted those CTU sinkhole servers, 22,360 from the US, 1,767 in the UK and 818 in India.

This provides a glimpse into the scourge that CryptoLocker has now become. But Keith Jarvis, a security researcher with Dell SecureWorks’ CTU, estimates the overall number of infected machines is now approximately 250,000.

“The actors infect machines in ‘waves’ so rates wax and wane between zero and around 5,000 a day,” he told El Reg.

Another Russian beastie?

Researchers have been rabidly delving through their CryptoLocker data in an attempt to determine its provenance. It first emerged in September, when early infections were found “disproportionately at financial institutions”, the CTU team said. Various industries have been targeted since then, from the hospitality sector to public utilities.

In the early days, the attackers solely went after businesses, sending out malicious ZIP archives in spam emails, but turned their attention to general PC owners soon enough.

Initial samples were downloaded from a server located in Missouri. Early versions included code to connect to an IP address located in a Phoenix NAP data centre in Arizona. The attackers have been hosting much of their activity on virtual private servers (VPS) located at different “bullet-proof” hosting providers across Russia and former Eastern bloc countries, who are either “indifferent to criminal activity on their networks or are complicit in its execution”, according to the CTU report.

This has led researchers to their suspicion that one gang of crooks based out of Eastern Europe or Russia are to blame.

“The majority of command and control servers hosting the CryptoLocker malware are located in the Russian Federation or the former Eastern bloc states, showing a knowledge of these infrastructure providers, and it is evident from the messages alerting the victims that English is not the CryptoLocker Group’s first language,” Jarvis added.

“This suggests that the threat actors behind CryptoLocker could be located somewhere in the Russian Federation or the former Eastern bloc states. Additionally, we have seen many hacker scams come out of this area of the world and target mainly English-speakers in the US and UK,” continued Jarvis. “We think it is wholly controlled and operated by a single crew, and not bought and sold on the underground.”

They’re using methods typical amongst Russian crooks, distributing it with the peer-to-peer (P2P) Gameover Zeus malware, in some cases via the Cutwail spam botnet or the Magnitude exploit kit.

Cryptolocker: In a class of its own

The reason why researchers are in such a spin about CryptoLocker is simple: it’s an advanced piece of ransomware, especially compared to the usual tripe that tells the user they’ve been caught doing nasty things and need to pay a fine. CryptoLocker follows through with its promise of encrypting users’ files, unlike other ransomware, and it does so with some finesse.

“This isn’t the first malware that destroys files, but it’s certainly in its own class,” Jarvis added.

Using the Microsoft CryptoAPI, Cryptolocker encrypts each file with a unique AES key, which is then encrypted with the RSA public key received from the crooks’ server. The malware has that public key, along with a small amount of metadata and the encrypted file contents, written back to disk, replacing the original files.

The only way to decrypt them is with the RSA private key held by the criminals, which can purportedly be acquired by handing over money, normally around 0.3 BTC. The CryptoLocker overlords also accept transfers over MoneyPak, another money transfer system.

Whilst some had suggested that payments did not result in decryption, victims have reported regaining access after coughing up. Sometimes, however, it takes weeks for the files to be unlocked. The crooks even created a “CryptoLocker Decryption Service” (see below) in early November, which gave people a chance to decrypt their docs even if they had not handed over the money before CryptoLocker’s ticking clock of doom hit 00:00. Early versions of this service charged 10 BTC, but then the value of a single bitcoin hit the $1000 mark, so the cost had to come down.

The masterminds have tried to avoid white hats by shifting around their C&C infrastructure. They’ve been using a domain generation algorithm (DGA) to create 1,000 potential command and control domain addresses per day, to be used alongside static servers for their villainous campaign. This dynamism appears to be working. Dell SecureWorks is now struggling to get meaningful stats from its sinkhole operation.

Cryptolocker won’t be disappearing in 2014. Indeed, it looks set to grow only larger – thanks to the wherewithal and technical nous of the gang behind it. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.